Subject: [ietf-dkim] issue: Section 2.6/ 3.5 AUID/i= should have pubkey t=s info

From: Hector Santos <[email-masked]>
Date: Tue, 03 May 2011 00:36:03 -0400

I think the definition of all tags in 3.5 should have as much critical 
information (or a section reference) that will not deviate from what 
is defined.

I think the definition of i= should include information about the 
public key t=s tag.  This t=s information that will deviate the "i=" 
definition is not found until 3.6.1 and 3.10.  The same can apply to 
section 2.6 Agent or User Identifier (AUID) which makes no mention of 
t=s or any reference to section 3.6.1, 3.10.

Possible small change in 3.5 i= definition, 2nd paragraph change:

       The syntax is a standard email address where the Local-part MAY be
       omitted.  The domain part of the address MUST be the same as, or a
       subdomain of, the value of the "d=" tag.  If the public key
       contains t=s, then the domain part of the address MUST match
       the value of "d=" tag.

Possible small change in 2.6:

    2.6.  Agent or User Identifier (AUID)

    A single identifier that refers to the agent or user on behalf of
    whom the Signing Domain Identifier (SDID) has taken responsibility.
    The AUID comprises a domain name and an optional <Local-part>.  The
    domain name is the same as that used for the SDID or is a sub-domain
    of it. If the public key contains t=s, then the domain name MUST
    be the same as SDID. For DKIM processing, ............

-- 
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Barry Leiba <[email-masked]>
Date: Thu, 5 May 2011 16:37:20 -0400

>    be the same as SDID. For DKIM processing, ............

These certainly aren't necessary, but I think they add clarity, so I
support adding the sentence in each place (after fixing the grammar).
While we're at it, we should change "sub-domain" in that 2.6 paragraph
to "subdomain", to be consistent with usage in the rest of the
document (the only place "sub-domain" is used is in the ABNF, where it
has to be).

Barry, as participant

---

From: Dave CROCKER <[email-masked]>
Date: Thu, 05 May 2011 14:23:12 -0700

>>        contains t=s, then the domain part of the address MUST match

Repeating or rephrasing specification text invites divergent interpretations.

If folks believe that it is important to create a linkage between the two 
segments of text, then make the reference be linkage, not repetition.

So, for example:

    Note the constraint on the value of "i=" that is imposed by the "t=s" tag of 
the stored key record. (See Section 3.6.1).

>>     The AUID comprises a domain name and an optional<Local-part>.  The

See above.

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Barry Leiba <[email-masked]>
Date: Thu, 5 May 2011 18:24:23 -0400

> Repeating or rephrasing specification text invites divergent interpretations.

Indeed, and I agree that not repeating is best.  On the other hand,
we're already repeating the part about "or a subdomain of", which is
why I support adding a notation about "except when t=s".

> the stored key record. (See Section 3.6.1).

That works for me.

Barry, as participant

---

From: Hector Santos <[email-masked]>
Date: Thu, 05 May 2011 21:43:44 -0400

Barry Leiba wrote:
>> public key t=s tag. �This t=s information that will deviate the "i="
>> definition is not found until 3.6.1 and 3.10. �The same can apply to
>> � � � The syntax is a standard email address where the Local-part MAY be
>> � � � omitted. �The domain part of the address MUST be the same as, or a
>> � � � subdomain of, the value of the "d=" tag. �If the public key
>> � � � contains t=s, then the domain part of the address MUST match
>> � � � the value of "d=" tag.
>>
>> � �2.6. �Agent or User Identifier (AUID)
>>
>> � �A single identifier that refers to the agent or user on behalf of
>> � �whom the Signing Domain Identifier (SDID) has taken responsibility.
>> � �The AUID comprises a domain name and an optional <Local-part>. �The
>> � �domain name is the same as that used for the SDID or is a sub-domain
>> � �of it. If the public key contains t=s, then the domain name MUST
>> � �be the same as SDID. For DKIM processing, ............
> 

Yes, I had pointed out either text or a reference to 3.6.1.

This document is filled with scattered information and section 3.5 
will be used a quick reference summary of the tags.

So I think "i=" should have this important "t=s" policy record 
exception highlighted some way.  They need to know if their 
implementations allows for the subdomain form to be inputted, that the 
public key management needs to "tied" to it.

So if my software has:

    Signer:  ____________________
    Selector:  ____________________
    Optional Agent or User Identity: _____________

when they press SAVE, I have to decide what to do, like Popop Warning box:

      Warning, the Public Key for this signer/selector must has
               a "t=s" tag

      Continue to Save:  Yes |  No

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 6 May 2011 11:46:27 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Barry Leiba
> Sent: Thursday, May 05, 2011 3:24 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [ietf-dkim] issue: Section 2.6/ 3.5 AUID/i= should have pubkey t=s info
> 

Seems minor, editorial and useful.  Added for the next version.